EU judgement on Facebook to take over a year

Any EU-level judgement on a case filed against Facebook for its alleged involvement in helping the Americans snoop on millions of people is likely to take over a year.

A contact at the Luxembourg-based European Court of Justice on Friday (20 June) said the case, initially filed by Austrian privacy campaigner Max Schrems with Ireland’s high court, could take up to 18 months.

Thank you for reading EUobserver!

EUobserver is an independent, not-for-profit news organization that publishes daily news reports, analysis, and investigations from Brussels and the EU member states. We are an indispensable news source for anyone who wants to know what is going on in the EU.

We are mainly funded by advertising and subscription revenues. As advertising revenues are falling fast, we depend on subscription revenues to support our journalism.

“They [high court] have to refer it to us, which can take weeks to months and once we get it registered here it could take up to 18 months before we pass any judgement on it,” said the contact.

Ireland’s high court adjourned and referred the case to the EU court on Wednesday in what is described by some as a decisive moment for privacy rights and the fight against corporate involvement in US-led mass surveillance.

Parliament’s lead data protection legislator German Green Jan Philipp Albrecht called it "a major step for data protection rights".

The complaint against Facebook is rooted in classified documents released to the public last year by former US agent Edward Snowden.

Facebook, along with Google, Yahoo and Microsoft, are said to have been involved in a top-secret US-led surveillance programme known as Prism.

Snowden’s exposures indicate the US spy hub, the National Security Agency (NSA), had paid the companies millions to help cover costs to run the global snooping operation.

Americans firms are supposed to follow EU laws whenever the personal data of EU citizens is transferred to the US under a so-called ‘adequacy decision’ arising from a 14-year old EU-US data pact known as Safe Harbour.

Schrems, for his part, had requested Ireland’s data protection commissioner Billy Hawkes to investigate Facebook over claims it violated the pact by collaborating with the Americans on Prism.

The company’s European headquarters is based in Dublin, which forwards all data on its international customers to the US.

Hawkes refused to launch a probe, noting he is bound by the European Commission’s findings in 2000, which described the US data protection regime as “adequate and effective”.

Schrems disagreed and then took the case to the Ireland’s high court.

Indications from the high court suggest the judges in Luxembourg will have to determine whether the European Commission’s Safe Harbour would still bind national authorities.

Once an ECJ verdict is reached, the case will then go back to the high court in Ireland.

The Irish court would then deal with the matter as it sees fit using the interpretation of the EU law the court had just delivered.

“Any questions of the consequences, so any order for Facebook to do or not do something and any fines or punishment for not following those orders is entirely a matter for the national courts,” said a second contact at the Luxembourg EU arbiter.

The European Commission, for its part, admitted to deficiencies in the data exchange pact.

“As a result of a lack of transparency and enforcement on the US side, some companies do not, in practice, comply with the scheme,” said EU justice commissioner Viviane Reding earlier this year.

The Brussels-executive stopped short of scrapping the pact and instead issued a series of recommendations on what the Americans need to do stick to their side of the agreement.